SSRF protection bypass via IPv4-mapped IPv6 literals (CVE-2026-2455)

Metric values as published in the disclosure vector. Meters show how far each value raises exposure.

1. Source · attacker-controlledserver/channels/app/post_metadata.go:1021

   App.getLinkMetadataForURL

2. 1
   Step 01server/channels/app/post_metadata.go:1021-1040

   Link preview/OpenGraph metadata fetching is one reachable path for user-controlled URLs. It creates a protected HTTP client with MakeClient(false).

   func (a *App) getLinkMetadataForURL(rctx request.CTX, requestURL string) (*opengraph.OpenGraph, *model.PostImage, error) {
       // ...
       client := a.HTTPService().MakeClient(false)
   

3. 2
   Step 02server/public/shared/httpservice/httpservice.go:88-115

   MakeClient(false) installs an allowIP callback that rejects reserved or self-assigned IPs unless explicitly allowed.

   allowIP := func(ip net.IP) error {
       reservedIP := IsReservedIP(ip)
   
       ownIP, err := IsOwnIP(ip)
       if err != nil {
           return fmt.Errorf("unable to determine if IP is own IP: %w", err)
       }
   
       if !reservedIP && !ownIP {
           return nil
       }
   
       if reservedIP {
           return fmt.Errorf("IP %s is in a reserved range and not in AllowedUntrustedInternalConnections", ip)
       }
       return fmt.Errorf("IP %s is a self-assigned IP and not in AllowedUntrustedInternalConnections", ip)
   }
   

4. 3
   Step 03server/public/shared/httpservice/client.go:129-164

   The transport resolves the hostname, checks each IP with allowIP, and dials the first allowed address.

   ips, err := net.LookupIP(host)
   if err != nil {
       return nil, err
   }
   
   for _, ip := range ips {
       if err := allowIP(ip); err != nil {
           forbiddenReasons = append(forbiddenReasons, err.Error())
           continue
       }
   
       conn, err := dial(ctx, network, net.JoinHostPort(ip.String(), port))
       if err == nil {
           return conn, nil
       }
   }
   

5. 4
   Step 04server/public/shared/httpservice/client.go:30-41

   The patch canonicalizes IPv4-mapped IPv6 addresses before checking reserved CIDRs, so ::ffff:127.0.0.1 is evaluated as 127.0.0.1.

   func IsReservedIP(ip net.IP) bool {
       if ip4 := ip.To4(); ip4 != nil {
           ip = ip4
       }
       for _, ipRange := range reservedIPRanges {
           if ipRange.Contains(ip) {
               return true
           }
       }
       return false
   }
   

6. Sinkserver/public/shared/httpservice/client.go:30

   IsReservedIP